chore(ci): Nx for github validations

[Nodonisko]

Nx can performs packages scrips only on smallest possible affected package tree. For example if you will only do changes to @trezor/suite it will check that package and packages that depends on it like suite-desktop. Other packages will be ignored (for example connect packages which doesn't depends on @trezor/suite).

That could speed things a lot and it's will be even better when we will split code into more smaller packages. More smaller packages => faster everything. More info about how Nx works here => https://nx.dev/getting-started/intro

It also has distributed caching that can speed things even more => https://nx.app

This implementation is very limited and we are using only very small subset of Nx features and there is huge space for improvements. Some of the improvements are here #6103

Closes #4936

[socket-security]

Socket Security Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 New install scripts detected

A dependency change in this PR is introducing new install scripts to your install step.

Package	Script field	Location
@parcel/watcher@2.0.4 (added)	binding.gyp	package.json via nx@14.5.10
nx@14.5.10 (added)	postinstall	package.json
@parcel/watcher@2.0.4 (added)	install	package.json via nx@14.5.10

🫣 Native code

Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.

Package	Location
@parcel/watcher@2.0.4 (added)	package.json via nx@14.5.10

Socket.dev scan summary

Issue	Status
Did you mean?	✅ no new possible package typos
Install scripts	⚠️ 3 new install scripts detected
Telemetry	✅ no new telemetry
Troll package	✅ no new troll packages
Malware	✅ no new malware
Native code	⚠️ 1 new native module detected

Powered by socket.dev

[vdovhanych]

Why is depth set to 0?

[Nodonisko]

It's recommended in Nx Githib actions guide, without this affected command will throw error because develop branch is not fetched

[matejkriz]

Maybe there is a way not to share access token publicly? This way we need to be very sure, that we don't rely on it for release builds.

[Nodonisko]

I think it doesn't matter for this kind of token, it's storing just hashes of packages, not actual build outputs. I would suggest definitely do more investigating before using it any kind of production stuff, but for validation it's good enough.

[Nodonisko]

I will generate read only token that will be here and generate new write token that will be set using env variables.

[Nodonisko]

Old token was invalidated, new one is read-only and second new one with RW rights will be distributed using env variable.